Oracle Patches 98 MySQL Vulnerabilities in October 2026 Update

TL;DR

Oracle fixed 98 MySQL vulnerabilities in its October 2026 Critical Patch Update. The two most severe, CVE-2025-15467 and CVE-2026-9547, score CVSS 9.8 and come from bundled OpenSSL and curl code. Most of the remaining MySQL flaws need high privileges and cause denial of service.

Why It Matters

MySQL powers a huge share of web applications, from small WordPress sites to large SaaS platforms. Therefore, even moderate MySQL vulnerabilities affect a very wide install base.

This quarter, the biggest risks do not sit in MySQL’s own code. Instead, they come from third-party libraries that Oracle bundles with the server and its tools. This pattern is common across the Oracle Critical Patch Update.

The Two Critical Flaws

CVE-2025-15467 – OpenSSL

This flaw affects the OpenSSL library inside MySQL Enterprise Backup and the MySQL Server build. An unauthenticated attacker can exploit it over TLS. Oracle rates the possible outcome as full takeover. The same patch also rolls up 29 related CVEs.

CVE-2026-9547 – curl

This flaw comes from the bundled curl library. It is reachable over HTTPS without credentials and can also lead to takeover. Notably, the patch rolls up more than 30 additional curl CVEs.

Other Notable MySQL Vulnerabilities

CVE-2026-101781 is the most serious bug in MySQL’s own code. It affects Group Replication and allows takeover. However, the attacker must sit on the same network segment as the server.

CVE-2026-101770 and two related client program flaws also allow takeover without a login. Oracle rates them as difficult to exploit, though.

Affected Versions

• MySQL Server: 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, and 26.7.0 to 26.7.1
• MySQL Cluster: 8.0.0 to 8.0.49, 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, and 26.7.0 to 26.7.1
• MySQL Enterprise Backup: 8.0.0 to 8.0.49, 8.4.0 to 8.4.12, 9.7.0 to 9.7.3, and 26.7.0
• Connector/J and MySQL Router: 26.7.0 for the flaws listed above

How Severe Is the Rest?

The bulk of these MySQL vulnerabilities carry lower risk. Out of 98 patches, 75 rate Medium. Furthermore, 45 require a high-privileged account. About two thirds can only crash or hang the server.

InnoDB and the Optimizer received the most fixes, with 18 and 14 patches. These bugs matter most on shared hosting and multi-tenant systems, where many users hold database accounts.

Patch and Mitigation Steps

Upgrade MySQL Server, Cluster, Enterprise Backup, Router, and Connectors to the fixed releases listed in the Oracle October 2026 advisory.

In the meantime, reduce exposure:

1. Do not expose port 3306 or MySQL Router ports to the internet.
2. Limit high-privileged database accounts, since many fixed flaws require them.
3. Isolate Group Replication traffic on a dedicated network segment.

The Bottom Line

The two CVSS 9.8 MySQL vulnerabilities come from OpenSSL and curl, not from MySQL itself. Patch Enterprise Backup and Server builds first. Then plan routine upgrades for the remaining lower-risk fixes.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.